RequestSignedUrl api call should return a clear error when a user is specified but doesn't exist
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 1.1k
- Forks
- 564
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 29
Description
-
What steps does it take to reproduce the issue?
Calling the RequestSignedUrl api with a not existing user in the request defaults to creation of a signed URL for the user associated with the token in the header of the request. -
Which page(s) does it occurs on?
API -
To whom does it occur (all users, curators, superusers)?
Superusers and other users authorized for signing URLs. -
What did you expect to happen?
The current code places the burden on the caller to determine whether the specified user exists and defaults to creating a signed URL on behalf of the caller instead of just failing. Returning an error code (e.g. 400/bad request) would simplify discovering this situation.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at the RequestSignedUrl API entry point and reproduce the call with a nonexistent specified user while authorized for signing URLs. Trace how that request selects the token-associated user, then identify the existing API error-handling and test locations. Done means the request returns a clear bad-request error instead of creating a URL for the caller.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- api
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 40/100